HF Legacy 
MIFARE Classic 4K
For existing stored-value and canteen applications with MIFARE Classic. Only partially readable by smartphone.
Security Broken
Memory 4 KB
MIFARE® DESFire® EV3: Technical Data, Security and Use
MIFARE DESFire EV3 is an HF/NFC chip from NXP for contactless applications at 13.56 MHz. It operates according to ISO/IEC 14443 Type A and ISO/IEC 14443-4, is certified as an NFC Forum Type 4 Tag and is offered with 2, 4, 8 or 16 kB of non-volatile memory. The flexible file system supports multiple applications on one chip as well as AES-128 for authentication and encrypted communication.
NXP currently lists MIFARE DESFire EV3 as an active product. We recommend the chip for secure company ID cards and multi-application cards. It is particularly suitable for new access control, ticketing, campus and multi-application systems that require separate applications and controlled key management.
| Feature | Value |
|---|---|
| Manufacturer | NXP Semiconductors |
| Product family | MIFARE DESFire |
| Type designation | MF3D(H)x3, variants with 2, 4, 8 and 16 kB |
| RFID class | HF / NFC |
| Frequency | 13.56 MHz |
| Standard | ISO/IEC 14443 Type A, ISO/IEC 14443-4; support for ISO/IEC 7816-4 |
| NFC standard | NFC Forum Type 4 Tag certified |
| Data rate | 106 / 212 / 424 / 848 kbit/s |
| NV memory / product variants | 2 / 4 / 8 / 16 kB |
| User memory for applications and files | 2,560 / 5,120 / 8,192 / 16,384 bytes of “available user memory”; management data for applications and files is allocated from this area |
| Memory structure | Flexible file system; multiple applications per chip; up to 32 files per application; five data file types plus Transaction MAC file |
| Authentication | Mutual authentication; AES as well as older DES/TDEA methods |
| Encryption | AES-128; additionally DES, 2K3DES and 3K3DES for backward compatibility |
| Secure Messaging | AES-based EV2 Secure Messaging; older D40/EV1 modes for backward compatibility |
| Key management | 1 PICC master key; up to 14 keys per application; up to 16 key sets per application; multiple key assignments per file access right possible |
| UID | 7-byte UID; optional random ID or configurable 4-byte NUID for communication |
| Anti-collision | Yes, according to ISO/IEC 14443 Type A |
| Read range | Up to 100 mm according to NXP, depending on reader, antenna and installation situation |
| Write cycles | At least 200,000, typically 1,000,000 at 25 °C |
| Data retention | 25 years at 25 °C |
| Secure Dynamic Messaging | Yes, SDM with dynamic data within NDEF messages |
| Transaction protection | Transaction MAC, Transaction Timer and anti-tear mechanisms |
| Additional security functions | Proximity Check, Originality Check and Virtual Card Architecture |
| Common Criteria | EAL5+ for hardware and software according to NXP |
| Smartphone NFC | Yes. NFC Forum Type 4/NDEF is smartphone-compatible; protected applications require a suitable app and the necessary permissions or keys |
| Product status at NXP | Active |
| Typical media | RFID/NFC card, key fob, wristband, ticket and special transponders |
| Security rating | High |
| Recommendation | For new access control, ID card, ticketing and multi-application systems with high security requirements |
MIFARE DESFire EV3 operates at 13.56 MHz and supports data rates of up to 848 kbit/s. NXP offers variants with 2, 4, 8 and 16 kB of memory. The chip supports AES-128, a flexible multi-application file system, NFC Forum Type 4 and security functions such as Transaction MAC, Proximity Check and Secure Dynamic Messaging.
Typical Applications
MIFARE DESFire EV3 is designed for contactless systems in which several functions, separate access rights or cryptographically protected transactions are to be combined on one medium. Among others, this chip type is suitable for the following areas of use:
- Access control and electronic company ID cards
- Ticketing in public transport
- Campus and student ID cards
- Smart city and mobility cards with multiple applications
- Closed-loop payment and loyalty systems
- Parking and toll systems
- Hospitality and event ticketing
Primarily RFID/NFC cards are suitable as media. Depending on the application and antenna design, key fobs, wristbands, tickets and special shapes are also possible.
Security
Security level: High
MIFARE DESFire EV3 supports AES-128, mutual authentication and MAC-protected or encrypted communication. NXP also cites Common Criteria certification of hardware and software to EAL5+. Functions such as Transaction MAC, Transaction Timer, Proximity Check and Originality Check complement the cryptographic protection for applications in which manipulation or relay attacks must be taken into account.
The high security level does not automatically apply to every configuration. For backward compatibility, the chip still supports DES, 2K3DES, 3K3DES and older communication modes. For new systems, the configuration should therefore be based on AES-128 and the AES-based EV2 Secure Messaging. Access rights and keys can be differentiated per application; multiple key sets also enable controlled key rollover.
The implementation in the overall system is also crucial. For MIFARE installations, NXP recommends, among other things, individual or diversified keys, regulated key changes and measures to detect misused cards. With an appropriate system design, MIFARE DESFire EV3 is therefore suitable for access control, identification, ticketing and closed-loop payment functions with high security requirements.
Advantages and Disadvantages of MIFARE DESFire EV3
| Advantages | Disadvantages |
|---|---|
| AES-128 and Common Criteria certification to EAL5+ | Higher price than simple HF/NFC chips |
| Flexible file system for multiple separate applications | Personalization and key management are comparatively complex |
| NFC Forum Type 4 and Secure Dynamic Messaging | Protected applications require a suitable app and permissions on smartphones |
| Transaction MAC, Transaction Timer and Proximity Check for additional protection | Older DES and TDEA methods remain available for compatibility reasons |
| Backward compatible with MIFARE DESFire EV2, EV1 and D40 | ISO/IEC 14443 support alone does not guarantee full reader compatibility |
Alternatives to MIFARE DESFire EV3
Depending on the existing infrastructure, smartphone use, security requirements and price, other chip types may be better suited.
HF / NFC Recommendation 
NTAG 213 / 215 / 216
For NFC applications with smartphones and NDEF content.
Security PWD
Memory 144–888 B
HF Recommendation 
LEGIC advant
For secure access control and multi-application solutions.
Security 3DES / AES
Memory 4 KB
Frequently Asked Questions about MIFARE DESFire EV3
How much memory does MIFARE DESFire EV3 have?
NXP offers MIFARE DESFire EV3 with 2, 4, 8 and 16 kB of non-volatile memory. The memory specification should not be equated directly with the pure user data area. In AN12752, NXP specifies 2,560, 5,120, 8,192 and 16,384 bytes of “available user memory” for the variants. In addition to the actual data, management information for applications and files is also created from this memory. Keys and configuration data at card level, on the other hand, are located outside this memory. How much space remains for the user data of a specific application therefore depends on its structure.
Which variants of MIFARE DESFire EV3 are available?
The family includes variants with 2, 4, 8 and 16 kB of memory. NXP also distinguishes chip variants with different input capacitances for different antenna designs. The type families MF3Dx3 and MF3DHx3 represent these variants. Which version is used for a card or transponder design depends, among other things, on the memory requirement, the inlay and the antenna design.
How secure is MIFARE DESFire EV3?
With a current AES configuration, MIFARE DESFire EV3 is designed for applications with high security requirements. The chip supports AES-128, mutual authentication, encrypted communication, Transaction MAC, Proximity Check and other protective functions. According to NXP, hardware and software are certified to Common Criteria EAL5+. Since older DES and TDEA methods are also supported for compatibility reasons, the actual security level depends on the chosen configuration and the key management of the overall system.
Can MIFARE DESFire EV3 be read with a smartphone?
In principle, yes. MIFARE DESFire EV3 is certified as an NFC Forum Type 4 Tag and can provide NDEF data. Android supports ISO-DEP according to ISO/IEC 14443-4 as well as NDEF on NFC Forum Type 4 Tags. Apple's Core NFC also supports NFC Forum tags and communication with the corresponding contactless chip protocols. Freely accessible NDEF content can therefore be implemented in a smartphone-friendly way. Protected DESFire applications, on the other hand, require a suitable app, the necessary commands and the corresponding keys or permissions.
Which readers support MIFARE DESFire EV3?
A reader must first support HF at 13.56 MHz as well as ISO/IEC 14443 Type A and ISO/IEC 14443-4. However, this alone does not guarantee full DESFire support. For protected applications, the reader software or the connected system must also support the required DESFire commands, authentication methods and keys. When switching from MIFARE Classic to MIFARE DESFire EV3, the existing reader infrastructure should therefore be checked specifically.
What is the difference between MIFARE DESFire EV3 and EV2?
MIFARE DESFire EV3 is the direct successor to DESFire EV2 and was designed so that existing EV2, EV1 and older D40 applications can continue to be supported. The additions of the EV3 generation include Secure Dynamic Messaging and the Transaction Timer, among others. Secure Dynamic Messaging can embed dynamically generated, cryptographically protected data in NDEF messages. This is relevant, for example, for NFC applications that can be verified on the server side.
Is MIFARE DESFire EV3 compatible with MIFARE Classic?
Not at the application level. Both product families operate at 13.56 MHz and are based on ISO/IEC 14443 Type A, but use different memory structures, commands and security methods. An existing reader that only processes MIFARE Classic therefore cannot automatically use a DESFire EV3 application. During migrations, the readers, backend, key management and card application must be checked together.
What is the read range of MIFARE DESFire EV3?
Under suitable conditions, NXP specifies an operating distance of up to 100 mm. This value is not a fixed real-world value. The distance actually achievable depends, among other things, on reader power, antenna geometry, transponder antenna, installation situation and ambient conditions. For access control and identification systems, the required read distance should therefore always be tested with the specific medium and the intended reader.
Is MIFARE DESFire EV3 still being produced?
Yes. As of September 2026, NXP lists the MIFARE DESFire EV3 product family as “Active”. It is therefore still intended for ongoing and new designs. For new projects, however, it should always be checked which memory and package variant is available for the planned application and the inlay used.
Technical sources
Data as of: September 2026
The technical information is based primarily on the NXP data sheet MIFARE DESFire EV3 contactless multi-application IC, document MF3D_H_X3_SDS, Rev. 3.1 dated 11 January 2024, and the current NXP product page for MF3DHx3. The memory structure and actually available user memory were additionally checked using the NXP Application Note MIFARE DESFire EV3 feature and functionality comparison to other MIFARE DESFire products, AN12752, Rev. 1.4 dated 24 July 2023.
The classification of applications is also based on the NXP fact sheet NXP® MIFARE® DESFire® EV3, Rev. 0 dated 18 May 2020. Statements on the security of the overall system take into account the NXP Application Note System level security measures for MIFARE installations, AN10969, Rev. 2.1 dated 22 April 2020.
The information on smartphone support is based on the Android documentation on IsoDep and NDEF and Apple's Core NFC documentation. Product status and document versions were checked against the current NXP product page in September 2026.
Trademark notice
MIFARE and DESFire are trademarks of NXP B.V.
The spelling on this page follows the MIFARE Trademark and Branding Guidelines, Rev. 5.2 dated 10 March 2025. As of September 2026, NXP still lists Rev. 5.2 as the current revision.